Official security bulletin

• 24 March 2008
• image uploaderkillbitsecuritysecurity issue
• Andrew

In my previous post I have mentioned about release of Image Uploader 5.1 (and 4.7) which has a number of security fixes (few known heap overflow and a bunch of potential problems). To prevent malicious persons to exploit these issues, we are releasing a killbit for all version and strongly recommend each customer of Image Uploader to get an update (which is free for appropriate major build).

Few words about killbit. I have already gave some comments on what is killbit and why we should use it in the Image Uploader is safe again post. Now let's see how killbit is installed on client machine. There are three ways: 

1. Killbit is set along with new version. So when new ActiveX is downloaded and installed, old CLSIDs become disabled.
2. Killbit can be installed manually. To do this just download the AurigmaKillbit.regfile and run it (may require administrative rights).
3. Killbit will be installed with Internet Explorer security updates. I cannot get an exact time frame for this until I get approval from Microsoft, but it will happen not earlier than in 2-3 months.

Below is described a list of CLSIDs which are killbited and their alternate CLSIDs.

Standard builds:

Private-label builds, Image Uploader 4:

Private-label builds, Upload Items 4:

Private-label builds, File Downloader

If you have a private-label version and do not see your CLSID there, please contact us at info@aurigma.com.

UPDATE (03/27/2008):

Few other CLSIDs we added to this killbit (see below). No more changes will be made to it though.

Also, I have got a confirmation from Microsoft that these CLSIDs will be killbited on June.

Private-label builds, Image Uploader 4:

Private-label builds, Upload Items 4: